Privacy Policy

Last updated: 18 July 2026

Controller: NextdoorSEC BV, Brusselstraat 38, Antwerp, Belgium, VAT BE0798791337 — scan@nextdoorsec.com.

What we process

• Free scan: the domain name you submit and your IP address (rate limiting, abuse prevention). Domain names of companies may constitute personal data in edge cases; we process them on the basis of legitimate interest (Art. 6(1)(f) GDPR) to provide the scan you requested. Scans read public DNS only.
• Purchases: name, email, billing country and VAT ID, processed by Stripe as payment processor. We receive no card numbers. Basis: contract performance (Art. 6(1)(b)) and legal (accounting) obligations (Art. 6(1)(c)).
• Analytics: privacy-respecting product analytics (PostHog EU) to understand feature usage. Basis: legitimate interest.

Retention

Scan inputs are retained up to 12 months for product improvement; purchase records as long as Belgian accounting law requires (7 years).

Your rights

Access, rectification, erasure, restriction, portability, objection: email scan@nextdoorsec.com. You may complain to the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).

Transfers & processors

Processors: Vercel (hosting), Stripe (payments), Supabase (data storage), PostHog EU (analytics). Where processing occurs outside the EEA, it is covered by adequacy decisions or SCCs.